Release v0.18.0

[itomek]

Why this matters

v0.18.0 ships agent memory v2 (hybrid-search second brain with LLM extraction and observability dashboard), ChatAgent split into three composable agents (Chat/FileIO/DocumentQA), parallel tool calls, and a Telegram adapter scaffold — plus fixes the RAG-on-PDF timeout with Gemma 4 that broke document Q&A since v0.17.6 and adds CI gates that enforce RAG quality baselines on every future PR.

Full notes: docs/releases/v0.18.0.mdx.

What's New

• Agent memory v2 (#606) — Hybrid semantic + keyword search, LLM extraction, observability dashboard via SSE streaming (#1032). Per-user isolation enforced; extraction runs async so it doesn't add latency.
• ChatAgent split (#979) — ChatAgent, FileIOAgent, and DocumentQAAgent replace the monolithic class; each composable via tools=. Backward-compatible shim preserved.
• Parallel tool calls (#946) — Multiple tool_calls from a single LLM turn are executed concurrently, cutting round-trips for multi-tool workflows.
• Telegram adapter scaffold, Phase 0 (#951) — gaia telegram start|stop|status, per-user session isolation, [telegram] extras. Phase 1 (message handling + allowed-users gate) tracked in #889.
• Connectors: per-MCP toggle + single-writer enforcement (#1018, #998) — Disable individual MCP servers without removing them; concurrent writes serialised with actionable errors on contention.
• File navigation, web browsing, and write security (#495) — FileSearchToolsMixin, web browsing tool, and scratchpad mixin in KNOWN_TOOLS; write tools check allowed_paths before dispatch.
• Email UI and policy alerts (#995, #1039, #952) — Pre-scan triage card, in-chat Connect, policy alert cards, and durable receipts for confirmation-gated actions.

Bug Fixes

• RAG-on-PDF timeouts on Gemma 4 (#1034, closes #1030) — Prompt-size budget check added at composition time; CI gates enforce it on every PR (#1040).
• Envelope-level parse failure crashed SD recovery (#1047, closes #1023) — Falls through to a clean recovery path with step-1 context preserved.
• Windows-path tool args corrupted (#1027) — Backslash normalisation now happens after argument parsing.
• Blender send_command hung (#1026, closes #1022) — Read timeout applied to persistent-connection servers.
• gaia chat init in post-install banner (#1029, closes #1024) — Replaced with the correct gaia init.
• Keyring treated as required (#1028) — Import guarded; optional on systems without keyring.
• electron-builder URLs stale (#953) — Three doc/installer files updated to current download paths.

Tooling & Docs

• RAG eval CI gates (#1040, closes #1033) — RAG quality baselines + prompt-size budget enforced on every PR.
• Fork-PR authors now receive Claude review (#932) — allowed_non_write_users: "*" with prompt-injection mitigations documented.
• Eval runs mandated before merging (#1036) — CLAUDE.md requires gaia eval agent for LLM-affecting changes.
• GAIA website (#369) — amd-gaia.ai live.
• Custom agent guide reorganised (#997), Lemonade PPA docs (#801), broken Lemonade CLI URL fixed (#996), WhatsApp adapter evaluation spec (#950).

Release checklist

• util/validate_release_notes.py docs/releases/v0.18.0.mdx --tag v0.18.0 passes
• src/gaia/version.py → 0.18.0
• src/gaia/apps/webui/package.json → 0.18.0
• Navbar label in docs/docs.json → v0.18.0 · Lemonade 10.2.0
• All 28 commits in range (v0.17.6..HEAD) are represented in the notes
• Review from @kovtcharov-amd addressed